Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A) Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.

Linked Issues

Issuelinks
Linktype Issue
is related to Techniques
is blocked by Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools
is blocked by Password Policies
is blocked by Multi-factor Authentication
is blocked by Security, Compliance & Resilience Controls Oversight
is blocked by Secure Baseline Configurations
is blocked by Continuous Monitoring
is blocked by Use of External Technology Assets, Applications and/or Services (TAAS)
is blocked by Separation of Duties (SoD)
is blocked by Identification & Authentication for Organizational Users
is blocked by Identifier Management (User Names)
is blocked by Authenticator Management
is blocked by Re-Authentication
is blocked by Account Management
is blocked by Access Enforcement
is blocked by Least Privilege
is blocked by Account Lockout
Impressum German English